Vulnerability Description
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 8.0 |
| Rubyonrails | Rails | 4.0.0 |
| Rubyonrails | Ruby On Rails | <= 3.2.22.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-beePatchVendor Advisory
- http://www.debian.org/security/2016/dsa-3509
- http://www.securityfocus.com/bid/83725
- http://www.securitytracker.com/id/1035122
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q
- https://www.exploit-db.com/exploits/40086/
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
FAQ
What is CVE-2016-2098?
CVE-2016-2098 is a vulnerability with a CVSS score of 7.3 (HIGH). Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of th...
How severe is CVE-2016-2098?
CVE-2016-2098 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-2098?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Rubyonrails Rails, Rubyonrails Ruby On Rails.